Can CNNs be made robust to tricks where small changes cause misclassification?
These are known as adversarial attacks, and the specific examples that are misclassified are known as adversarial examples.
There is a reasonably large body of work on finding adversarial examples, and on making CNNs more robust (i.e. less prone to these attacks). An example is the DeepFool algorithm, which can be used to find perturbations of data which would cause the label to change.
There are several techniques in the literature which are used to fight against adversarial attacks. Here is a selection:

Augmenting the training data with various random perturbations. This is intended to make the model more robust to the typical adversarial attack where random noise is added to an image. An example of this approach is discussed in [1].

Constructing some sort of model to &quot;denoise&quot; input before feeding into the CNN. An example of this is Defense-GAN [2], which uses a generative adversarial model which models the &quot;true&quot; image distribution and finds an approximation of the input closer to the real distribution.


References
[1] Ian J. Goodfellow, Jonathon Shlens &amp; Christian Szegedy. Explaining and Harnessing Adversarial Examples. ICLR (2015). URL.
[2] Pouya Samangouei, Maya Kabkab, Rama Chellappa. Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models. ICLR (2018). URL.